The RDMA/siw subsystem registers a queue pair before all components of that resource are fully initialized. This ordering problem allows a lookup by queue pair number to resolve to an object that is still in construction, creating a use‑of‑uninitialized‑memory condition (CWE‑908). The advisory does not specify concrete consequences, so the impact is potentially unstable kernel behavior or undefined activity when the RDMA stack uses the incomplete structure.

Any installation of the Linux kernel that contains the legacy RDMA/siw stack prior to the application of the siw_qp_add ordering fix is vulnerable. The advisory does not list specific kernel releases or distributions, so any system that has not applied the latest kernel patches for the RDMA/siw subsystem remains at risk.

The CVSS score of 7.8 denotes high severity. The EPSS score of less than 1 % indicates a very low likelihood of active exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves sending crafted RDMA traffic that triggers a queue pair number lookup while the associated resource is still incomplete. The description does not confirm that this leads to a crash or denial of service; the effect could be kernel instability or failure.